BurnWithdrawTicket is permissionless. I think that could be fine, but the problem is that min_out is passed via the Instruction. This could be abused by triggering a lot of slippage and burning other peoples withdraw tickets with a min_out of 0
We don't want vault withdrawal tickets sitting around as they cause a yield drag on the assets in the vault and can allow someone to continue earning rewards, but frontrun withdraws.
via Felix @ Asymmetric:
We don't want vault withdrawal tickets sitting around as they cause a yield drag on the assets in the vault and can allow someone to continue earning rewards, but frontrun withdraws.